Europe’s AI Act Now Has Investigators
By Suad Seferi ·
For years, Europe’s approach to artificial intelligence was discussed mainly through draft laws, risk categories, voluntary codes and future deadlines. That phase is ending. From August 2, 2026, the European Commission’s AI Office and national authorities begin exercising key enforcement powers under the EU AI Act. Brussels is also strengthening the teams responsible for investigating possible violations, examining powerful general-purpose AI models and responding when AI systems create serious risks. The AI Act is no longer only a rulebook. It is becoming an enforcement system. From regulation to investigation The European Commission’s AI Office was established to coordinate implementation of the AI Act across the European Union. Its most important direct responsibility concerns general-purpose AI models, including the foundation models behind many chatbots, coding assistants, content generators and AI agents. Until now, most public attention has focused on what companies must disclose and which systems fall into different risk categories. The harder questions begin now. Who decides whether a model presents a systemic risk? What evidence must a company provide? How will regulators test systems that are constantly updated? And what happens when a model behaves differently in real-world use than it did during internal testing? The AI Office includes teams focused on regulation, compliance and AI safety. Their work will include examining possible infringements, assessing model risks and supporting enforcement across the EU. The Commission has also appointed an independent scientific panel to assist regulators with model evaluation and systemic-risk assessment. That matters because enforcing AI rules cannot depend only on lawyers reviewing company documents. Regulators will increasingly need technical experts capable of testing models, examining their capabilities and challenging claims made by developers. What regulators will examine The EU’s attention is not limited to visible deepfakes or chatbots that fail to identify themselves. Regulators are also concerned about broader risks linked to advanced models, including their potential use in cyberattacks, manipulation, illegal content generation and other activities that may affect public safety or fundamental rights. The European Commission has direct authority over certain general-purpose AI providers, while national authorities remain responsible for many AI systems deployed within individual member states. This shared structure reflects how modern AI systems operate. A model may be developed by a company in the United States, hosted in another country, integrated into software by a European business and then used by citizens across several jurisdictions. No single national regulator can easily supervise that entire chain. Europe is therefore building a system in which central institutions examine the most powerful models, while national authorities supervise how AI is used in workplaces, public services, healthcare, education, policing and other sensitive areas. Insiders will be able to report violations The AI Office also operates a whistleblower mechanism through which people connected to AI providers can report suspected violations. Employees, contractors and business partners may have access to internal evaluations, safety failures or company decisions that never become public. External researchers and journalists usually see only the final product. Insiders may know whether a company ignored a serious risk, concealed a failed test or released a model before safety concerns were resolved. A confidential reporting channel gives regulators another way to identify problems before they grow into larger incidents. Its success, however, will depend on trust. People must believe that reports will be treated seriously, their identities will be protected and the AI Office has the capacity to investigate the information it receives. The real test is enforcement against powerful companies Passing a law is easier than enforcing it against some of the world’s largest technology companies. Major AI providers have strong legal teams, large technical departments and substantial financial resources. Their systems are also complex enough that regulators may struggle to independently reproduce company evaluations or determine whether a safety measure is genuinely effective. Europe must avoid two opposite failures. The first would be weak enforcement, where companies submit large amounts of documentation but face little technical scrutiny. The second would be enforcement that becomes so slow and bureaucratic that smaller European developers carry a heavier burden than the global corporations the law was designed to oversee. The credibility of the AI Act will depend on whether regulators can distinguish between real risk and minor administrative mistakes. A startup that makes an honest reporting error should not be treated in the same way as a powerful provider that hides a serious capability or repeatedly ignores safety obligations. Proportionate enforcement will be one of the biggest challenges. Why this matters for the Balkans Western Balkan countries are outside the European Union, but they will not remain outside the influence of this enforcement system. Regional companies provide software, outsourcing, data services, technical support and digital products to clients across the EU. Some operate AI tools that can be accessed by European users. Others integrate models developed by global providers into services used by banks, schools, public institutions and businesses. The question will no longer be only whether an organisation uses AI. Companies may increasingly need to know which model they use, where data is processed, how outputs are reviewed, what risks were identified and who is responsible when the system fails. This will matter particularly for organisations working in regulated sectors or participating in European projects. It will also mat…